PapaTramp/RDP-login-monitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
176 Commits 1 Branch 1 Tag
2c1724fd90967dcfe91b67ae32549853801a74d3
Commit Graph

46 Commits

Author SHA1 Message Date
PTah fb50fb3ea7 chore: bump version to 2.1.0-SAC 2026-06-19 23:42:08 +10:00
PTah 80b2337d61 fix(winrm): Exchange strict mode to suppress false 91/4624 alerts 
On Exchange role: require user in WinRM Event 91 EventData; correlate 4624 only when LogonProcess is WinRM. Prevents Outlook/LT3 false positives. Version 2.0.23-SAC.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-05 11:07:21 +10:00
PTah bd83dc84dc fix: StrictMode-safe File Share audit init (UseGuid key) 
Enable-SecurityAudit crashed on init when checking RU/EN File Share attempts because accessing UseGuid on a hashtable without that key throws under Set-StrictMode -Version Latest.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-04 10:20:17 +10:00
PTah afded8a495 docs: README highlights table and 2.0.19-SAC admin share 5140 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-04 10:17:11 +10:00
PTah 6384a45395 fix: recognize auditpol RU Success+Failure as otказ not only sboy (2.0.17-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-03 15:08:20 +10:00
PTah 5e5bc86e1b docs: add one-command quick start for first install 
Put NETLOGON deploy flow at the top of README so initial setup is straightforward: run one command and verify with log tail.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 13:28:28 +10:00
PTah 42d6af83f2 docs: add 5-minute WinRM stabilization checklist 
Document quick post-deploy validation for Enter-PSSession -> WinRM 91 -> SAC event flow and minimal noise-suppression guidance.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 13:26:32 +10:00
PTah 52e9e62ede docs: refresh README for WinRM and current SAC integration state 
Update current RDP monitor version and document recent WinRM parsing, deploy self-heal, and skip reason diagnostics behavior.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 13:25:16 +10:00
PTah d54d04623f fix: PS 5.1 Sac-Client JSON types without uint alias 2.0.2-SAC 
Replace [uint]/[ulong] -is checks with GetType().IsPrimitive for Windows PowerShell 5.1 on domain hosts.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 09:13:19 +10:00
PTah 084494cfa8 fix: SAC JSON serialize daily report without PSMethod cycle 2.0.1-SAC 
Convert-AnyToJsonSerializable returns plain arrays and skips PSMethod/ScriptBlock instead of Generic.List objects that broke JavaScriptSerializer.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 09:08:14 +10:00
PTah 1a1467f910 chore: bump release to 2.0.0-SAC 
Major version line so Deploy upgrades agents stuck on 1.6.x and older 1.2.x-SAC builds from NETLOGON.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-06-01 09:03:48 +10:00
PTah 78f241df32 feat: add Diagnose-RdpLoginMonitor.ps1 for post-login troubleshooting 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 18:40:10 +10:00
PTah b56ad9c7e4 feat: daily report agent version line and per-line active users (1.2.28-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 11:28:29 +10:00
PTah e738d97c9c chore: release 1.2.27-SAC (deploy version compare + docs) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 11:18:58 +10:00
PTah 1fe8bd9f7d fix(deploy): version compare for -SAC labels; refresh deploy docs 
Compare deployed_version.txt with full label (e.g. 1.2.26-SAC) so GPO deploy exits when up to date. Restructure deploy-rdp-login-monitor.md with mermaid flow, Exchange vs DomainMonitors split, and remove duplicated sections.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-31 11:13:33 +10:00
PTah 724baa6c0a feat: monitor RDS Shadow Control and WinRM inbound (warning alerts, 1.2.23-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-30 10:20:57 +10:00
PTah 1f27272883 fix: dedup 4624 login alerts and log Skip/dedup reasons (1.2.18-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 15:17:01 +10:00
PTah 49359c07a6 fix: tolerate missing ServerDisplayName and send host.ipv4 (1.2.17-SAC) 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 13:33:26 +10:00
PTah 611d9c68ca chore: bump RDP monitor version to 1.2.16-SAC 
Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 13:01:20 +10:00
PTah 737da07d6a fix: add Exchange 4624 LT3 empty-IP filter switch 
Add configurable `${Ignore4624-LT3-EmptyIP-Event}` for RDP monitor to suppress noisy 4624 network logons with empty IP (-) on mail/Exchange hosts.
Update settings example and README with usage instructions.

Co-authored-by: Cursor <cursoragent@cursor.com>
 2026-05-28 12:35:40 +10:00
PTah 3ed20b130f chore: bump release to 1.2.5-SAC 
Raise ScriptVersion/version.txt for Sac-Client payload product_version and
update README release reference to keep docs aligned.
 2026-05-27 15:53:29 +10:00
PTah bd8076a1d0 docs: Windows/SAC update checklist; default Telegram in settings example 2026-05-27 14:27:27 +10:00
PTah edbe00ffb3 feat: SAC client 1.2.0-SAC and daily report details for ingest 2026-05-27 14:15:16 +10:00
PTah 577b8bc220 feat(Login): вынести локальные настройки в login_monitor.settings.ps1 
Секреты, SMTP, 4740 и IP-исключения больше не в Login_Monitor.ps1 —
не слетают при автообновлении с NETLOGON. Deploy создаёт settings из example при первой установке.
 2026-05-25 09:44:43 +10:00
PTah 9ab6cc64a1 docs: add Docs/ guides; Exchange Mail Security scripts (v1.6.0) 
- Docs: RDP deploy, Exchange mail security, NETLOGON publish
- Exchange-MailSecurity.ps1, Notify-Common, Deploy/Install-DomainMonitors
- DEPLOY.md redirects to Docs/
 2026-05-22 14:32:50 +10:00
PTah 40c557f041 feat: aggregated 4625 burst alerts (two-tier rate limit, v1.5.10) 
- Tier 1: 5 failures per 60s per IP+user
- Tier 2: 12 failures per 60s per IP (spraying)
- Suppress per-event 4625 during burst; no auto-ban
 2026-05-22 14:13:06 +10:00
PTah ab98eab49c fix: invoke auditpol by full path when System32 is missing from PATH (v1.5.6) 2026-05-22 10:41:59 +10:00
PTah f4375c2349 readme and docs editing 2026-05-22 09:19:26 +10:00
PTah 52b1723137 feat: ignore.lst for 4740, IIS time window, stale heartbeat alert (v1.5.3) 
- ignore.lst scopes: 4740:/all: prefixes; IP rules match IIS client IPs
- IIS ActiveSync IPs only within minutes before lockout event
- Alert when last_heartbeat.txt is older than 2x HeartbeatInterval
 2026-05-19 20:46:35 +10:00
PTah b7786e8690 feat: AD lockout 4740 with IIS IPs and SMTP notifications (v1.5.2) 
Monitor Security 4740 on a configured domain controller and enrich alerts
with ActiveSync client IPs from IIS logs. Add unified Telegram and email
delivery with NotifyOrder. Update README and DPAPI helper for mail password.
 2026-05-19 19:47:23 +10:00
PTah bdcf2bdc5f docs: expand ignore.lst section in README and README_eng 2026-05-04 09:02:14 +10:00
PTah 17befc867e Document ignore.lst in README and DEPLOY 
Describe optional Security 4624/4625 suppression, UTF-8, and that deploy does not ship ignore.lst.
 2026-05-04 07:56:49 +10:00
Andrey Lutsenko e96131d722 docs: refresh README, add English README_eng.md 
Document daily report, deploy marker, SkipScheduledTaskMaintenance, and legacy watchdog scripts. Add full English translation.
 2026-05-03 18:52:18 +10:00
PTah d26784fb7f Refresh README for current ProgramData + Deploy workflow 2026-04-30 16:43:14 +10:00
PTah 02424875fb Add repository search keywords to README 2026-04-30 16:34:26 +10:00
PTah e0b0fa3d7e Watchdog: schtasks /Run после установки; DEPLOY/README про задачи и UNC; версия 1.3.4 2026-04-29 16:07:35 +10:00
PTah 80f57c5351 Добавлен доменный деплой (Deploy-LoginMonitor.ps1, version.txt), DEPLOY.md, правки README и комментарий к версии в Login_Monitor.ps1 2026-04-29 15:14:41 +10:00
PTah 4f0b6e219c Add Install-ScheduledTasks.ps1 for Task Scheduler registration; document in README 2026-04-13 11:29:21 +10:00
PTah b164e51965 README: remove internal PMG/LDAP filter details from public docs 2026-04-13 11:23:44 +10:00
PTah 685ef5260a Clarify startup Telegram: Gateway targets internal PCs; exclude Gateway-only from RDS host line 2026-04-13 10:53:10 +10:00
PTah 2826e3f9cd Telegram startup: mention RDS and RD Gateway when applicable 2026-04-13 10:49:30 +10:00
PTah 848381e098 Use UTF-8 BOM for logs; document FAR encoding 2026-04-13 10:33:11 +10:00
Луценко Андрей Анатольевич 99ab020347 Document recent monitoring and auditpol improvements 2026-04-11 22:16:13 +10:00
Луценко Андрей Анатольевич c5a4c26b1e Add editor/gitattributes defaults for PowerShell encoding 2026-04-11 21:23:27 +10:00
PapaTramp 89acb0a914 Update README.md 2026-04-09 16:42:00 +10:00
Луценко Андрей Анатольевич 21ad87d08d Add login monitor, watchdog and Task Scheduler docs 2026-04-09 16:36:27 +10:00